Connected: An Internet Encyclopedia
RFC 1510 - A.12. KRB_AP_REP verification

Top: Connected: An Internet Encyclopedia
Up: Requests For Comments
Up: RFC 1510
Up: A. Pseudo-code for protocol processing
Prev: A.11. KRB_AP_REP generation
Next: A.13. KRB_SAFE generation

### A.12. KRB_AP_REP verification

            receive packet;
            if (packet.pvno != 5) then
                    either process using other protocol spec
                    or error_out(KRB_AP_ERR_BADVERSION);
            endif
            if (packet.msg-type != KRB_AP_REP) then
                    error_out(KRB_AP_ERR_MSG_TYPE);
            endif
            cleartext := decrypt(packet.enc-part)
                         using ticket's session key;
            if (decryption_error()) then
                    error_out(KRB_AP_ERR_BAD_INTEGRITY);
            endif
            if (cleartext.ctime != authenticator.ctime) then
                    error_out(KRB_AP_ERR_MUT_FAIL);
            endif
            if (cleartext.cusec != authenticator.cusec) then
                    error_out(KRB_AP_ERR_MUT_FAIL);
            endif
            if (cleartext.subkey is present) then
                    save cleartext.subkey for future use;
            endif
            if (cleartext.seq-number is present) then
                    save cleartext.seq-number for future verifications;
            endif
            return(AUTHENTICATION_SUCCEEDED);

Next: A.13. KRB_SAFE generation

Connected: An Internet Encyclopedia
RFC 1510 - A.12. KRB_AP_REP verification